#mmc20
Explore tagged Tumblr posts
Visit Tumblr Blog
Explore Tumblr blogs with no restrictions, modern design and the best experience.
Last Seen Tumblr Blogs
Fun Fact
The most popular pages on Tumblr are about Minecraft, GIFs, and David J. Peterson.
Photo
Just received in the mail one of my perennial favorite albums- Panda Bear, Person Pitch on White and Blue 45RPMs. Beogram 8000 with MMC20 CL.
50 notes
·
View notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Top 10 of the Week
CONCERT – Christina Aguilera
The Grammy Award-winning superstar pop icon, and winning coach on The Voice, kicks off her new North American tour right here in South Florida, in support of this year’s “Liberation” release.
Tues, September 25: 8pm; Hard Rock Event Center (1 Seminole Way, Hollywood); Tix:$112.00 to $337.00
COMEDIAN – Jerry Seinfeld
America’s premier comedian returns to the Arsht Center to perform his signature stand-up routine! Seinfeld has been hailed for his uncanny ability to joke about the little things in life that relate to audiences everywhere. His latest projects include the Emmy nominated web series, Comedians in Cars Getting Coffee, and his Netflix special Jerry Before Seinfeld.
Fri, September 21; 8pm; Arsht Center for the Performing Arts (1300 Biscayne Blvd, Miami); Tix: start at $72.50
CONCERT – Drake
Brings his Aubrey and the Three Migos Tour to south Florida for 2 performances. Drake has received many accolades, including three Grammy Awards, three Juno Awards, six American Music Awards, and thirteen Billboard Music Awards. He is the RIAA’s top certified digital singles artist, having moved 142 million units of digital singles in the US.[23] In 2018, USA Today declared him the biggest artist of the year.
Fri & Sat, Sept 21 and 22; American Airlines Arena (601 Biscayne Boulevard, Miami); Tix: start at $159.
ICON – An Evening With Al Pacino
During a 50-year career, Al Pacino has won an Academy Award, two Tony Awards, two Primetime Emmy Awards, a British Academy Film Award, four Golden Globe Awards, the Lifetime Achievement Award from the American Film Institute, the Golden Globe Cecil B. DeMille Award and the National Medal of Arts. From “The Godfather” to “Scarface,” the evening includes personal reflections, film clips and an audience question-and-answer session.
Sat, September 22; 8pm; The Fillmore (1700 Washington Ave. Miami Beach); Tix: $83.50 to $303.50
MOVIES – Love Gilda
One of the greatest comedians of all times, Gilda Radner, was taken from this earth way too early. In her own words, comedienne Gilda Radner looks back and reflects on her life and career. Weaving together recently discovered audiotapes, interviews with her friends, rare home movies and diaries read by modern day comediennes (including Amy Poehler), LOVE Gilda offers a unique window into the honest and whimsical world of a beloved performer whose greatest role was sharing her story.
In theaters Fri Sep 21; Documentary stars Andrew Alexander, Anne Beatts, Chevy Chase, Bill Hader
REALITY TV – Voice and DWTS
Two of the hottest reality TV shows return to compete with each other. Thevoice features coaches Blake Shelton, Adam Levine, Kely Clarkson and Jennifer Hudson. Dancing with the Stars cast will feature: Nancy McKeon, Milo Manheim, Aalexis Ren, Evanna Lynch, Nikki Glaser, John Schneider, Mary Lou Retton, Demarcus Ware, Bobby Bones, Danelle Umstead, Juan Pabol di Pace, Joe Amabile, and Tinashe
Mon, September 24; 8pm; On NBC and ABC respectively.
TRIBUTE BAND – Heart
All Heart music is played and sung very authentically, in true homage to Heart! The band features the powerhouse vocals of Tiffany Hoffelder who can belt out the power hits, or sweetly deliver the softer songs. Also featuring vocalist, guitarist Robyn Fear who is a natural fit fluidly covering guitar parts and harmony vocals. Band leader Mylo Anthony covers bass and additional harmony vocals, Denis Casaubon handles keyboard work, Mike McAuliffe doubles up on keyboards and lead guitar, and Anthony Vomero keeps the beat rocking on drums.
Sun, September 23; Boca Black Box (8221 Glades Road #10, Boca Raton) Tix: $20; BocaBlackBox.com.
COUNTRY – Lee Ann Womack
The Grammy-winning country singer has also earned six Country Music Association awards and five Academy of Country Music awards. She has sung for multiple presidents, and dueted with Willie Nelson, John Prine and John Legend. She is touring in support of her latest album, “The Lonely, The Lonesome & The Gone.”
Sat, September 22; 7:30 pm; Bailey Hall (3501 Davie Road, Davie) Tix: $40 to $86; baileyhall.org.
REEFER – Concert
The 20th Annual Medical Marijuana Benefit Concert hosted by NORML of Florida, Ploppy Palace Productions, and Modern Galaxy TV promises to be a celebration like none before. Throughout its two-decade long run, the concert has featured many local and regional acts, but this year, reggae legends Inner Circle will top the bill.
Sat, September 22; 4:20pm; Wow House (3100 NW 7th Avenue, Miami); Tix: Early Bird $25; bit.ly/MMC20;
GAME OF THRONES – Live concert
This experience Features Ramin Djawadi who will bring the world of Westeros South Florida. Fans will have the opportunity to watch in wonder as famed composer Ramin Djawadi leads an orchestra and choir performing music from all seven seasons of the iconic, Emmy® Award-winning HBO series. The show will include new music and footage from Season 7, as well as a new custom stage design and mesmerizing visuals courtesy of state of the art video technology.
Sat, September 22; 8pm; BB&T Center (1 Panther Parkway, Sunrise); Tix: start at $21; Thebbtcenter.com
source https://hotspotsmagazine.com/2018/09/19/top-10-of-the-week-4/ from Hot Spots Magazine https://hotspotsmagazin.blogspot.com/2018/09/top-10-of-week_19.html
0 notes
Text
Top 10 of the Week
CONCERT – Christina Aguilera
The Grammy Award-winning superstar pop icon, and winning coach on The Voice, kicks off her new North American tour right here in South Florida, in support of this year’s “Liberation” release.
Tues, September 25: 8pm; Hard Rock Event Center (1 Seminole Way, Hollywood); Tix:$112.00 to $337.00
COMEDIAN – Jerry Seinfeld
America’s premier comedian returns to the Arsht Center to perform his signature stand-up routine! Seinfeld has been hailed for his uncanny ability to joke about the little things in life that relate to audiences everywhere. His latest projects include the Emmy nominated web series, Comedians in Cars Getting Coffee, and his Netflix special Jerry Before Seinfeld.
Fri, September 21; 8pm; Arsht Center for the Performing Arts (1300 Biscayne Blvd, Miami); Tix: start at $72.50
CONCERT – Drake
Brings his Aubrey and the Three Migos Tour to south Florida for 2 performances. Drake has received many accolades, including three Grammy Awards, three Juno Awards, six American Music Awards, and thirteen Billboard Music Awards. He is the RIAA’s top certified digital singles artist, having moved 142 million units of digital singles in the US.[23] In 2018, USA Today declared him the biggest artist of the year.
Fri & Sat, Sept 21 and 22; American Airlines Arena (601 Biscayne Boulevard, Miami); Tix: start at $159.
ICON – An Evening With Al Pacino
During a 50-year career, Al Pacino has won an Academy Award, two Tony Awards, two Primetime Emmy Awards, a British Academy Film Award, four Golden Globe Awards, the Lifetime Achievement Award from the American Film Institute, the Golden Globe Cecil B. DeMille Award and the National Medal of Arts. From “The Godfather” to “Scarface,” the evening includes personal reflections, film clips and an audience question-and-answer session.
Sat, September 22; 8pm; The Fillmore (1700 Washington Ave. Miami Beach); Tix: $83.50 to $303.50
MOVIES – Love Gilda
One of the greatest comedians of all times, Gilda Radner, was taken from this earth way too early. In her own words, comedienne Gilda Radner looks back and reflects on her life and career. Weaving together recently discovered audiotapes, interviews with her friends, rare home movies and diaries read by modern day comediennes (including Amy Poehler), LOVE Gilda offers a unique window into the honest and whimsical world of a beloved performer whose greatest role was sharing her story.
In theaters Fri Sep 21; Documentary stars Andrew Alexander, Anne Beatts, Chevy Chase, Bill Hader
REALITY TV – Voice and DWTS
Two of the hottest reality TV shows return to compete with each other. Thevoice features coaches Blake Shelton, Adam Levine, Kely Clarkson and Jennifer Hudson. Dancing with the Stars cast will feature: Nancy McKeon, Milo Manheim, Aalexis Ren, Evanna Lynch, Nikki Glaser, John Schneider, Mary Lou Retton, Demarcus Ware, Bobby Bones, Danelle Umstead, Juan Pabol di Pace, Joe Amabile, and Tinashe
Mon, September 24; 8pm; On NBC and ABC respectively.
TRIBUTE BAND – Heart
All Heart music is played and sung very authentically, in true homage to Heart! The band features the powerhouse vocals of Tiffany Hoffelder who can belt out the power hits, or sweetly deliver the softer songs. Also featuring vocalist, guitarist Robyn Fear who is a natural fit fluidly covering guitar parts and harmony vocals. Band leader Mylo Anthony covers bass and additional harmony vocals, Denis Casaubon handles keyboard work, Mike McAuliffe doubles up on keyboards and lead guitar, and Anthony Vomero keeps the beat rocking on drums.
Sun, September 23; Boca Black Box (8221 Glades Road #10, Boca Raton) Tix: $20; BocaBlackBox.com.
COUNTRY – Lee Ann Womack
The Grammy-winning country singer has also earned six Country Music Association awards and five Academy of Country Music awards. She has sung for multiple presidents, and dueted with Willie Nelson, John Prine and John Legend. She is touring in support of her latest album, “The Lonely, The Lonesome & The Gone.”
Sat, September 22; 7:30 pm; Bailey Hall (3501 Davie Road, Davie) Tix: $40 to $86; baileyhall.org.
REEFER – Concert
The 20th Annual Medical Marijuana Benefit Concert hosted by NORML of Florida, Ploppy Palace Productions, and Modern Galaxy TV promises to be a celebration like none before. Throughout its two-decade long run, the concert has featured many local and regional acts, but this year, reggae legends Inner Circle will top the bill.
Sat, September 22; 4:20pm; Wow House (3100 NW 7th Avenue, Miami); Tix: Early Bird $25; bit.ly/MMC20;
GAME OF THRONES – Live concert
This experience Features Ramin Djawadi who will bring the world of Westeros South Florida. Fans will have the opportunity to watch in wonder as famed composer Ramin Djawadi leads an orchestra and choir performing music from all seven seasons of the iconic, Emmy® Award-winning HBO series. The show will include new music and footage from Season 7, as well as a new custom stage design and mesmerizing visuals courtesy of state of the art video technology.
Sat, September 22; 8pm; BB&T Center (1 Panther Parkway, Sunrise); Tix: start at $21; Thebbtcenter.com
from Hotspots! Magazine https://hotspotsmagazine.com/2018/09/19/top-10-of-the-week-4/ from Hot Spots Magazine https://hotspotsmagazine.tumblr.com/post/178247399715
0 notes
Text
Lateral Movement using the MMC20.Application COM Object
SNPX.com : Lateral Movement using the MMC20.Application COM Object http://dlvr.it/N3Psz2
0 notes
Text
Favorite tweets
[Blog] Lateral Movement using the MMC20.Application COM Object:https://t.co/AWb3F1IKmU
— Matt Nelson (@enigma0x3) January 5, 2017
from http://twitter.com/enigma0x3 via IFTTT
0 notes
Video
instagram
Philly is holding it down in Harrisburg tonight! I'm up next! #MMC20 (at Grain + Verse Bottlehouse)
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes
Text
Original Post from FireEye Author: Brett Hawkins
Background
As a follow up to Part One in this blog series on COM object hunting, this post will talk about taking the COM object hunting methodology deeper by looking at interesting COM object methods exposed in properties and sub-properties of COM objects.
What is a COM Object?
According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.”
A COM object’s services can be consumed from almost any language by multiple processes, or even remotely. COM objects are usually obtained by specifying a CLSID (an identifying GUID) or ProgID (programmatic identifier). These COM objects are published in the Windows registry and can be extracted easily, as described below.
COM Object Enumeration
FireEye performed research into COM objects on Windows 10 and Windows 7, along with COM objects in Microsoft Office. Part One of this blog series described a technique for enumerating all COM objects on the system, instantiating them, and searching for interesting properties and methods. However, this only scratches the surface of what is accessible through these COM objects, as each object may return other objects that cannot be directly created on their own.
The change introduced here recursively searches for COM objects, which are only exposed through member methods and properties of each enumerated COM object. The original methodology looked at interesting methods exposed directly by each object and didn’t recurse into any properties that may also be COM objects with their own interesting methods. This improvement to the methodology assisted in the discovery of a new COM object that can be used for code execution, and new ways to call publicly known code execution COM object methods.
Recursive COM Object Method Discovery
A common theme among publicly discovered techniques for code execution using COM objects is that they take advantage of a method that is exposed within a child property of the COM object. An example of this is the “MMC20.Application” COM object. To achieve code execution with this COM object, you need to use the “ExecuteShellCommand” method on the View object returned by the “Document.ActiveView” property, as discovered by Matt Nelson in this blog post. In Figure 1 you can see how this method is only discoverable within the object returned by “Document.ActiveView”, and is not directly exposed by the MMC20.Application COM object.
Figure 1: Listing ExecuteShellCommand method in MMC20.Application COM object
Another example of this is the “ShellBrowserWindow” COM object, which was also first written about by Matt Nelson in this blog post. As you can see in Figure 2, the “ShellExecute” method is not directly exposed in the COM object. However, the “Document.Application” property returns an instance of the Shell object, which exposes the ShellExecute method.
Figure 2: Listing ExecuteShellCommand method in ShellBrowserWindow COM object
As evidence of the previous two examples, it is important to not only look at methods exposed directly by the COM object, but also recursively look for objects with interesting methods exposed as properties of COM objects. This example also illustrates why simply statically exploring the Type Libraries of the COM objects may not be sufficient. The relevant functions are only accessed after dynamically enumerating objects of the generic type IDispatch. This recursive methodology can enable finding new COM objects to be used for code execution, and different ways to use publicly known COM objects that can be used for code execution.
An example of how this recursive methodology found a new way to call a publicly known COM object method is the “ShellExecute” method in the “ShellBrowserWindow” COM object that was shown previously in this article. The previously publicly known way of calling this method within the “ShellBrowserWindow” COM object is using the “Document.Application” property. The recursive COM object method discovery also found that you can call the “ShellExecute” method on the object returned by the “Document.Application.Parent” property as seen in Figure 3. This can be useful from an evasion standpoint.
Figure 3: Alternative way to call ShellExecute with ShellBrowserWindow COM object
Command Execution
Using this recursive COM object method discovery, FireEye was able to find a COM object with the ProgID “Excel.ChartApplication” that can be used for code execution using the DDEInitiate method. This DDEInitiate method of launching executables was first abused in the “Excel.Application” COM object as seen in this article by Cybereason. There are multiple properties in the “Excel.ChartApplication” COM object that return objects that can be used to execute the DDEInitiate method as seen in Figure 4. Although this DDEInitiate method is also exposed directly by the COM object, it was initially discovered when looking at methods exposed in the other objects accessible from this object.
Figure 4: Different ways to call DDEInitiate with Excel.ChartApplication COM object
This COM object can also be instantiated and used remotely for Office 2013 as seen in Figure 5. The COM object can only be instantiated locally on Office 2016. When trying to instantiate it remotely against Office 2016, an error code will return indicating that the COM object class is not registered for remote instantiation.
Figure 5: Using Excel.ChartApplication remotely against Office 2013
Conclusion
The recursive searching of COM object methods can lead to the discovery of new COM objects that can be used for code execution, and new ways to call publicly known COM object methods. These COM object methods can be used to subvert different detection patterns and can also be used for lateral movement.
#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source Author: Brett Hawkins Hunting COM Objects (Part Two) Original Post from FireEye Author: Brett Hawkins Background As a follow up to Part One in this blog series on COM object hunting…
0 notes